1. Technical Field of the Invention
The present invention relates generally to an electronic control system designed to electronically control an operation of an actuator such as an electric motor working to open or close a throttle valve for use in automotive engines, and more particularly to such a system designed to self-monitor a drive command issued to a driver circuit of a vehicle-mounted actuator from a microcomputer and also to monitor such a self-monitoring operation through a monitor module simultaneously.
2. Background Art
Japanese Translation of International Publication No. 11-505587 teaches the above type of electronic control system. FIG. 24 illustrates a typical electronic control system including the structure, as disclosed in the publication.
The electronic control system is designed to control an operation of an electric motor which works to open or close a throttle valve mounted in an automotive vehicle. The electronic control system consists essentially of a microcomputer 10, a monitor module 20, and a driver circuit 30.
The microcomputer 10 works to perform given operations to control the driving of the motor. Specifically, the microcomputer 10 includes an input circuit 11, a controller 12, a self-monitor 13, a program running circuit 14, and a communication circuit 15. The monitor module 20 includes a communication circuit 22 and a malfunction decision circuit 21.
The controller 12 receives an input signal indicative of an effort or position of an accelerator pedal through the input circuit 11 and computes a controlled variable of the motor for the throttle valve and outputs it to the driver circuit 30 in the form of a drive command.
The input signal is also received by the self-monitor 13. The self-monitor 13 works to analyze the drive command, as produced by the controller 12, to monitor the validity thereof. Specifically, the self-monitor 13 performs an operation, which is substantially identical with that in the controller 12, on the input signal, compares a result of the operation with the drive command, as sampled from the controller 12, and outputs a result of the comparison to the driver circuit 30 in the form of an information signal as representing the validity of the drive command.
The program running circuit 14 works to execute a monitoring program with the aid of the monitor module 20 to decide whether the self-monitor 13 is malfunctioning or not. Specifically, the program running circuit 14 is responsive to a test signal, as inputted from the monitor module 20 through the communication circuit 15, to initiate the monitoring program. The program running circuit 14 first outputs data, as specified by the monitoring program, to the self-monitor 13 to perform a given computation on the data and then samples and outputs a result of the computation to the monitor module 20 in the form of a data signal through serial communication between the communication circuit 15 and the communication circuit 22.
The monitor module 20 is implemented by an IC or a backup computer which is designed to sample the data signal inputted from the program running circuit 14. Specifically, the malfunction decision circuit 21 is responsive to input of the data signal to compare it with an expected value, as stored therein, and outputs a result of the comparison to the driver circuit 30 as representing a result of the monitoring of the self-monitor 13. The malfunction decision circuit 21 also works to output the test signal cyclically to the program running circuit 14 of the microcomputer 10.
The driver circuit 30 is responsive to the drive command, as outputted from the controller 12, to open or close the throttle valve through the motor and also receives outputs from the self-monitor 13 and the malfunction decision circuit 21. When the output from the self-monitor 13 indicates the fact that the result of computation, as produced in the self-monitor 13, does not match the drive command, as produced by the controller 12, or when the output from the malfunction decision circuit 21 indicates the fact that the value of the data signal does not match the expected value, the driver circuit 30 decides that the reliability of the drive command is low and enters a fail-safe mode to ignore the drive command.
As apparent from the above discussion, the electronic control system, as illustrated in FIG. 24, is designed to monitor both the drive command to be inputted to the driver circuit 30 through the self-monitor 13 and the malfunction of the monitoring operation of the self-monitor 13, thus resulting in improved reliability in controlling the throttle valve, but however, encounters the following drawback.
When the program running circuit 14 is responsive to the test signal from the monitor module 20 to monitor the validity of the operation of the self-monitor 13, it will cause the monitoring of the controller 12 (i.e., the drive command) by the self-monitor 13 to be interrupted by the program running circuit 14. It is, thus, impossible to determine the validity of the drive command outputted from the controller 12 to the driver circuit 30 during the monitoring operation of the monitor module 20. There is still left room for improvement of the reliability in controlling the throttle valve. In favor of the monitoring of the controller 12 by the self-monitor 13, it is possible to decrease the number of times the malfunction decision circuit 21 outputs the test signal to the program running circuit 14, but however, resulting in decreased reliability in monitoring the self-monitor 13 through the monitor module 20.